Credit Card Getting Charged Twice

[badarac]

I had the same issue on a client site recently and it appears to have been a timing issue. The default time for the checkout button to be disabled is 4 seconds. I made the following change to includes/modules/pages/checkout_confirmation.php on a 1.5.1 site:
Original

function submitonce()
{
  var button = document.getElementById("btn_submit");
  button.style.cursor="wait";
  button.disabled = true;
  setTimeout('button_timeout()', 4000);
  return false;
} 

New

function submitonce()
{
  var button = document.getElementById("btn_submit");
  button.style.cursor="wait";
  button.disabled = true;
  setTimeout('button_timeout()', 20000);
  return false;
} 

4000 becomes 20000

They have not had a duplicate order since making this change.